MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Jun 18, 2026 | Jun 12, 2026 |
| Debian | — | Upgrade mariadb | Jul 12, 2026 | Jul 12, 2026 |
| Freebsd | — | Upgrade mariadb118-serverUpgrade mariadb1011-serverUpgrade mariadb114-serverUpgrade mariadb106-server | Jun 15, 2026 | May 29, 2026 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Jun 24, 2026 | Jun 12, 2026 |
| Redhat_linux | — | Upgrade Judy-debuginfoUpgrade mariadb-client-utilsUpgrade mariadb11.8-commonUpgrade mariadb-serverUpgrade mariadb-gssapi-serverUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb11.8-server-galeraUpgrade mariadb10.11-debuginfoUpgrade mariadb11.8-test-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade galera-debugsourceUpgrade mariadb11.8-debugsourceUpgrade mariadb-oqgraph-engineUpgrade galeraUpgrade mariadb11.8-server-utilsUpgrade mariadb-testUpgrade mariadb11.8Upgrade mariadb11.8-embedded-develUpgrade mariadb11.8-errmsgUpgrade mariadb-backupUpgrade mariadb11.8-testUpgrade mariadb11.8-oqgraph-engine-debuginfoUpgrade mariadb11.8-embeddedUpgrade mariadb-debuginfoUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-pamUpgrade mariadb11.8-serverUpgrade JudyUpgrade mariadb11.8-debuginfoUpgrade mariadb11.8-client-utilsUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-develUpgrade galera-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-backup-debuginfoUpgrade mariadbUpgrade mariadb-commonUpgrade mariadb-test-debuginfoUpgrade mariadb11.8-server-debuginfoUpgrade mariadb-server-galera-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade mariadb10.11-debugsourceUpgrade mariadb-server-galeraUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb-errmsgUpgrade mariadb11.8-server-galera-debuginfoUpgrade mariadb11.8-pam-debuginfoUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb11.8-backupUpgrade mariadb-embedded-debuginfoUpgrade Judy-debugsourceUpgrade mariadb11.8-develUpgrade mariadb11.8-oqgraph-engineUpgrade mariadb11.8-pam | Jul 3, 2026 | Jun 12, 2026 |
| Rocky_linux | — | Upgrade mariadb-test-debuginfoUpgrade mariadb11.8-pamUpgrade mariadb-server-galeraUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade Judy-debuginfoUpgrade mariadb11.8-develUpgrade mariadb11.8-oqgraph-engine-debuginfoUpgrade mariadb10.11-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-gssapi-serverUpgrade mariadb-server-utils-debuginfoUpgrade galera-debugsourceUpgrade mariadb11.8-embedded-develUpgrade mariadb-server-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-develUpgrade mariadb11.8-server-galera-debuginfoUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-client-utilsUpgrade galeraUpgrade mariadb11.8-testUpgrade mariadb-pam-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb11.8-server-galeraUpgrade mariadb-debuginfoUpgrade mariadbUpgrade mariadb11.8-embeddedUpgrade mariadb11.8-debuginfoUpgrade mariadb11.8-serverUpgrade JudyUpgrade mariadb11.8-debugsourceUpgrade mariadb11.8-backupUpgrade mariadb-serverUpgrade mariadb11.8-server-debuginfoUpgrade mariadb10.11-debugsourceUpgrade mariadb11.8-test-debuginfoUpgrade mariadb11.8-pam-debuginfoUpgrade mariadb-server-galera-debuginfoUpgrade galera-debuginfoUpgrade mariadb11.8-oqgraph-engineUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb-pamUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backupUpgrade mariadb-commonUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb-errmsgUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade Judy-debugsourceUpgrade mariadb11.8Upgrade mariadb-testUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engine-debuginfo | Jul 3, 2026 | Jun 30, 2026 |
| Ubuntu | — | Upgrade mariadb-server | Jul 14, 2026 | Jun 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | Jun 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub